GWM Engine
Immobilizer
Improving little by little everyday
Contents
Chapter 1 Description of Immobilizer
Chapter 2 Structure and Composition of Immobilizer
Chapter 3 Difference in Immobilizer Principles
Chapter 4 Description of Immobilizer Matching
2-44
Improving little by little everyday
Chapter 1 Description of Immobilizer
Presently, GWM engine immobilizers adopt the products of three
manufacturers, Delphi, STEC and DIAS.
Delphi immobilizer STEC immobilizer control unit DIAS immobilizer
control unit control unit
3-44
Improving little by little everyday
Delphi immobilizer falls into Delphi gasoline engine
immobilizer, Delphi 2.8TC diesel fuel engine immobilizer
and Delphi 4D20 diesel fuel engine immobilizer. Delphi
gasoline engine immobilizers are used for Haval,
Wingle and Cowry gasoline cars; Delphi 2.8TC diesel
fuel engine immobilizers are used for Haval and Wingle
2.8TC diesel cars. Delphi 4D20 diesel fuel engine
immobilizers are used for Haval 4D20 Delphi diesel
cars.
STEC immobilizers are used for GWM Peri, Florid Haval
M1 (mini), Phelex and Voleex C30.
DIAS immobilizers are used for Coolbear and Haval M2.
4-44
Improving little by little everyday
GWM Engine Immobilizer
Delphi STEC DIAS
immobilizer immobilizer immobilizer
Delphi Delphi diesel Delphi 4D20
gasoline engine 2.8TC diesel engine
engine immobilizer immobilizer
immobilizer
Haval, Haval and Haval 4D20 GWM Peri, Haval M1 Coolbear, Haval
Wingle and Wingle 2.8TC Delphi diesel (mini), Florid, Phelex, M2
Cowry diesel cars engine cars Voleex C30
gasoline
cars
5-44
Improving little by little everyday
GWM engine immobilizers must pass the encrypted authentication of key
(with immobilizer transponder), immobilizer control unit and engine ECU
before starting.
When igniting, the user must communicate the key with transponder with the
immobilizer control unit to perform key authentication.
Engine
Coil
Immobilizer control
control unit module
(ECM)
When igniting, the user must After key authentication, After ECM passes
communicate the key with the immobilizer will authentication, the
transponder with the perform communication
engine can be normally
immobilizer controller to authentication for ECM.
started.
perform key authentication.
6-44
Improving little by little everyday
Chapter 2 Structure and Composition of Immobilizer
The three immobilizers all consist of coil, transponder, control unit,
ECU, indicator lamp and connecting harness.
Immobilizer
control unit
Coil
Mechanical key
Immobilizer Transponder
indicator lamp
7-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer control unit
Immobilizer (IMMO):
This is an electronic control module including microprocessor and
several semiconductor elements. It is the core of the entire immobilizer
and the main functions include:
(1) Operation function
To achieve various encryption and decryption algorithm and compare
the data.
8-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer control unit
(2) Communication function
Through the two-way wireless data communication with transponder to achieve
encryption authentication of key
W-Line bus communication: to achieve encryption authentication of engine
management module; R-Line bus communication: to originate request signal to
immobilizer for ECU; K-Line bus communication: to achieve communication with
fault diagnostic tester and allow the entire immobilizer system matching, learning
and fault diagnosis. (STEC and DIAS)
K-Line bus communication: to achieve encryption authentication of engine
management module and communication with diagnostic tester. (Delphi
immobilizer)
9-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer control unit
STEC and DIAS immobilizer Delphi immobilizer
W-line
Engine
Immobil Engine Immobil K-line
ECU
izer R-line ECU izer
control control
unit unit
K-line
K-line
Caution
Diagno Diagno
stic The diagnostic tester of STEC and stic
tester DIAS immobilizer communicates with tester
engine ECU through immobilizer
control unit and W-line
10-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer control unit
(3) Control function
– To achieve the task scheduling of overall system and
control the communication of all levels
(4) Drive function
– To drive the coil to yield electromagnetic signal and
supply energy required for transponder operation;
– To drive the immobilizer indicator lamp to work.
11-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer control unit
Cautio
n
Peri immobilizer
control unit
Phelex immobilizer
control unit
Peri and Florid immobilizer
system has been updated. The
transponder and immobilizer
ECU are the same as those used
Florid immobilizer in Phelex models.
control unit
12-44
Improving little by little everyday
Immobilizer subassembly- Coil
Coil
– It is mounted in the ignition lock barrel and connected to the
immobilizer control module with a conductor of certain length. As the
load of immobilizer control module, it bears the task of transmitting
signal and energy between immobilizer control module and
transponder.
13-44
Improving little by little everyday
Immobilizer subassembly- Coil
Immobilizer Coil resistance (Ω)
Delphi 30---32
STEC 5---30
DIAS 8---10
14-44
Improving little by little everyday
Immobilizer subassembly-Transponder
Transponder:
– Each motor key has a transponder that contains a calculation chip
and a fine electromagnetic coil. This fine coil will complete the
transmission of signal and energy between the immobilizer control
module and transponder calculation chip together with the
immobilizer coil.
– The transponder is built in the key.
15-44
Improving little by little everyday
Immobilizer subassembly-Transponder
– After the ignition switch is turned on, driven by immobilizer control
module, the coil will establish electromagnetic field around it. Through
the excitation of this field, the electromagnetic coil in the transponder
will supply the electric energy required for the immobilizer control unit
calculation chip operation and transmit various electronic data
information between the calculation chip and immobilizer control
module.
– In this way, the key requires no special power supply inside for the
operation of transponder and no periodic replacement of battery.
– Delphi immobilizer only allows the matching of two transponders;
STEC immobilizer allows the matching of 5 transponders; DIAS
immobilizer allows the matching of 8 transponders.
16-44
Improving little by little everyday
Immobilizer subassembly-Transponder
Delphi
immobilizer
transponder
Delphi immobilizer transponder can match different
vehicles for many times
17-44
Improving little by little everyday
Immobilizer subassembly-Transponder
Transponder before Transponder after
alteration alteration bears white
paint dot
Peri and Florid immobilizer system has been updated. The
transponder and immobilizer ECU are the same as those
used in Phelex models.
STEC and DIAS transponders can match in one vehicle only.
The matched transponder can perform matching with the
immobilizer control unit with the same password as that of
this transponder only.
18-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer indicator lamp
STEC immobilizer will be turned on when the ignition switch is turned off.
The indicator lamp will twinkle at a frequency of illuminating for 0.25s and
turning off for 4s.
With ignition switch in ON, if the authentication passes, the indicator lamp
will turn off; if the authentication fails, the indicator lamp will keep twinkling
while the engine service indicator lamp (the small wrench symbol) will
twinkle as well.
The immobilizer indicator lamp of Peri,
Haval M1 and Voleex C30 is integrated in
the instrument; the indicator lamp of Immobilizer indicator lamp of
Phelex is in the auxiliary instrument (at Florid is in the instrument desk
the electronic clock position).
19-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer indicator lamp
DIAS immobilizer will be turned on when the
ignition switch is turned off. The immobilizer
indicator lamp will twinkle at a frequency of
illuminating once every 5s.
With ignition switch in ON, if the authentication
passes, the indicator lamp will turn off; if the
authentication fails, the indicator lamp will keep
twinkling.
If the authentication of transponder and
immobilizer control unit fails, the immobilizer
indicator lamp will illuminate once every 0.5s; if Immobilizer
the authentication of immobilizer control unit indicator lamp
and engine ECU fails, the immobilizer indicator
lamp will illuminate once every 2s while the
engine service indicator lamp (the small wrench
symbol) will twinkle as well.
20-44
Improving little by little everyday
Immobilizer subassembly-Immobilizer indicator lamp
Delphi immobilizer will be turned on when the ignition switch is turned off.
The immobilizer indicator lamp will twinkle at a frequency of illuminating
once for 50ms every 2s.
With ignition switch in ON, if the authentication passes, the indicator lamp
will turn off; if the authentication fails, the indicator lamp will keep twinkling
at a frequency of 1Hz and 50% duty ratio lamp will twinkle.
Immobilizer indicator lamp of Immobilizer indicator lamp of Cowry
Haval and Wingle is in the is in the front left windshield
instrument instrument desk
21-44
Improving little by little everyday
Circuit diagram of Coolbear immobilizer
Ignition switch Immobilizer
A4 indicator lamp
A3
A1
A2
Battery
Diagnostic tester
A7
Key with
transponder B2
B3 A8
A5
Coil
22-44
Improving little by little everyday
Definition of Coolbear immobilizer pins
Front view of immobilizer ECU connector A Front view of immobilizer ECU connector B
Definition of terminals:
23-44
Improving little by little everyday
Circuit diagram of STEC immobilizer
Ignition
end
Indicat
or lamp ON + － +
A4 A1 Battery
Ignition _
switch A2
R-line
A5
LED Engine
Immobiliz W-line management
A3 A8
er control system
unit
A
B1
Coil
B B2
K-line
B3 A7 Diagnostic
Screening tester
24-44
Improving little by little everyday
Definition of STEC immobilizer pins
7 5 3 1
3 2 1
8 6 4 2
Immobilizer control unit interface A pins Immobilizer control unit interface B pins
25-44
Improving little by little everyday
Definition of STEC immobilizer pins
Definition of immobilizer control unit interface A pins Definition of immobilizer control unit interface B pins
Pin Pin No. Pin definition
Rated Operating
Pin definitio
voltage current Pin1 A end of coil connector
n
Pin 1 To B+ 12V <200mA
Pin2 B end of coil connector
Pin 2 Ground 0V <200mA
Pin3 GND
Pin 3 To LED 12V <50mA
Pin 4 To ON 12V <50mA
Pin 5 To R-LINE 12V <200mA
Not
Pin 6 --- ---
connected
Pin 7 To K-LINE 12V <200mA
Pin 8 To W-LINE 12v <200mA
26-44
Improving little by little everyday
Circuit diagram of Delphi immobilizer
Ignition switch
B3
B4
Battery B2
Immobilizer ECU
Diagnost
ic tester
Engine
ECU B7
Warning lamp
B1
+12V A1
A3
Transponder Coil
27-44
Improving little by little everyday
Definition of Delphi
immobilizer pins
B1 Warning Lamp A1 Coil positive
B2 GND A2 N/U
B3 IGN A3 Coil negative
B4 Battery
B5 N/U
B6 N/U
B7 K-Line (Diagnose)
B8 N/U
28-44
Improving little by little everyday
Chapter 3 Principle of Immobilizer
Immobilizer authentication process- DIAS
Wireless communications authentication
– a) When the user inserts the key in the ignition lock and turns on the
ignition switch, the immobilizer control module will first challenge key
transponder ID through the coil of ignition lock and then the transponder
will transmit the unique ID to immobilizer control module for verification.
– b) After this, the immobilizer control module will transmit a set of random
electronic data to the key transponder, the chip of which will perform
specific operation through the received data together with Password and
SK and feed back the operation result to the immobilizer control module.
The control module in turn will compare this result and that calculated by
itself; if the results coincide, the system will authorize this key.
29-44
Improving little by little everyday
Immobilizer authentication process-DIAS
Key - immobilizer module
authentication
30-44
Improving little by little everyday
Immobilizer authentication process- DIAS
Bus communication authentication
– a) After authorizing the key, the immobilizer control module will originate the
authentication communication of engine management system control module
through the bus.
– b) Both will perform mutual authentication similar to the above. The engine
control module will perform specific encryption operation with its own PIN
together one random number and SK. The immobilizer control module will
decrypt the received data and verify the validity of PIN. If the PIN is consistent
with the pre-stored one, the immobilizer control module will return a set of
random electronic data to the engine control module, which will compare this
result with that made by the specific encryption operation. Where the results
coincide, the engine control module will perform the further operation to allow
ignition, fuel injection, ensure start and operation.
31-44
Improving little by little everyday
Immobilizer authentication process- DIAS
Engine - immobilizer
module authentication
32-44
Improving little by little everyday
Immobilizer authentication process- DIAS
Transponder Immobilizer control unit Electronic
injection control
unit
Key ID A1 Compar Random
Key ID A2
e A1, A2 number B
PIN Encryption algorithm
Generating (random number C, PIN, SK)
Encryption algorithm
random number A
(random number A, Password, SK)
Encryption algorithm
(random number C, Generating result
D2) D2
Encryption algorithm
(random number A, Password, SK) Comp
are
Specific
PIN
encryption
Generating result B12 algorithm
Random
number Random
Comp E1 number
Generating result B1 are
E2
B1,
Compa
B2
re E1,
E2
33-44
Improving little by little everyday
Immobilizer authentication process- STEC (before system update)
Transponder Immobilizer control unit Electronic injection
control unit
Compar Key ID A2
Key ID A1 e A1, A2
Random number B
Encryption algorithm
(random number B, key C)
Encryption algorithm
(random number B, key C)
Generating result D2
Generating result D1 Compar
e D1, D2
34-44
Improving little by little everyday
Immobilizer authentication process- STEC (after system update)
Transponder Immobilizer control unit Electronic injection
control unit
Key ID A1 Compare
A1, A2 Key ID A2
Decryption algorithm Random number Encryption
(random number A, D1) A + transponder algorithm Transponder
password D1 after (random number password
encryption A,
transponder
Transpo password) Encryption algorithm Random number B
nder Compare (random number B, key
passwor password C)
Generating
d
random
number A Encryption algorithm
Recei (random number B, key C)
Encryption algorithm Receiver Generating result
ver (random number, password D1
passw receiver password)
ord
Generating result D2
Decryption
algorithm
Receiver password D2 (random Compare
after encryption numbers, D2) receiver Compa
password re
D1, D2
35-44
Improving little by little everyday
Immobilizer authentication process- Delphi
Condition: the engine can be started only Transponder
after #1 and #2 password authentication The protocol of transponder and
passes! immobilizer control unit + enciphering
function form the front end encryption.
➢#1 password authentication Front end encryption
➢#2 password ➢Password
authentication authentication
ECM Immobilizer Diagnostic
control unit tester
Terminal encryption
Service end encryption
The communication protocol of immobilizer control unit
The specific communication protocol of and diagnostic tester often follows some open entire
engine ECM and immobilizer ECU + vehicle protocols, therefore, it adopts some strategies
enciphering function in the ECM and ECU to effectively protect the vehicles against hostile attack
form the terminal encryption. of professional thieves.
36-44
Improving little by little everyday
Chapter 4 Description of Immobilizer Matching
Immobilizer enciphered data
• The off-line matching process is one process of cryptographic data
generation and mutual transmission of immobilizer parts. Below is
the three main cryptographic data required for authentication of
immobilizer.
Key ID
Each transponder has the unique built-in feature code.
37-44
Improving little by little everyday
Immobilizer enciphered data
Key code (SK)
The immobilizer control unit has built-in fixed number
or random number generated by immobilizer module
used for the key of immobilizer data encryption.
The key codes of Delphi and STEC immobilizer control units are built-in.
During immobilizer control unit learning, the key codes will become
consistent with those of current engine ECU.
New DIAS immobilizer control unit does not have built-in key code and the
codes will be generated randomly during system matching or written in
when learning immobilizer control unit.
38-44
Improving little by little everyday
Immobilizer enciphered data
Personal identification number (PIN)
PIN is the authorization code to access diagnostic system
PIN of Delphi and STEC immobilizers is 4-bit consisting of hexadecimal figures
and letters.
PIN of DIAS immobilizer is 8-bit consisting of hexadecimal figures and letters.
Caution: PIN (user authorization code) should be provided by the user and
there security envelop for engine electronic immobilizer PIN in the attached
documents; where the user losses the password, he can apply in "small
wrench"- - - "information management"- - - -"engine electronic immobilizer
code read application sheet" and the After-Service Department will handle
the application. (refer to the figure in the next page)
39-44
Improving little by little everyday
Immobilizer enciphered data
40-44
Improving little by little everyday
Initial state
• During off-line matching or replacing new key, new engine ECU or
immobilizer control unit, ensure the standard immobilizer module (SIM), key
(transponder) and engine ECU are under initial state, as show in below
figure. Note: DIAS immobilizer new part does not have SK.
Key Immobilizer ECM
Initial state
41-44
Improving little by little everyday
Matching state
• During off-line matching, ensure the standard immobilizer module (SIM),
key (transponder) and engine control module (ECM) are under initial state
Key Immobilizer ECM
Matching state
42-44
Improving little by little everyday
Review of Course
Chapter 1 Description of Immobilizer
Chapter 2 Structure and Composition of Immobilizer
Chapter 3 Difference in Immobilizer Principles
Chapter 4 Description of Immobilizer Matching
43-44
Improving little by little everyday
44-44
